CVE-2025-10353
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-10-08

Last updated on: 2025-12-11

Assigner: Spanish National Cybersecurity Institute, S.A. (INCIBE)

Description
File upload leading to remote code execution (RCE) in the “melis-cms-slider” module of Melis Technology's Melis Platform. This vulnerability allows an attacker to upload a malicious file via a POST request to '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' using the 'mcsdetail_img' parameter.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-10-08
Last Modified
2025-12-11
Generated
2026-06-16
AI Q&A
2025-10-08
EPSS Evaluated
2026-06-14
NVD
CVE-2025-10353
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
melis_technology melis_core *
melis_technology melis_cms *
melis_technology melis_cms_slider *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-43 The product accepts path input in the form of multiple trailing dot ('filedir....') without appropriate validation, which can lead to ambiguous path resolution and allow an attacker to traverse the file system to unintended locations or access arbitrary files.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the melis-cms-slider module of Melis Platform, where an attacker can upload a malicious file via a POST request to the '/melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm' endpoint using the 'mcsdetail_img' parameter. This file upload flaw can lead to remote code execution (RCE), allowing the attacker to execute arbitrary code on the affected system.

Impact Analysis

The vulnerability can allow an attacker to execute arbitrary code remotely on the affected system without any privileges or user interaction. This can lead to full system compromise, data theft, service disruption, or further attacks within the network.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-10353. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart